Qatar Airlines app crashes if any module is applied to the app

[lyubomyr-shaydariv]

Steps to reproduce/复现步骤

Yesterday I came across an issue reported on Reddit. In the discussion thread it was mentioned that LSPosed modules cause QA to crash. On my device I can also reproduce these steps. This is similar to the issue I reported a few days ago #405, however, it behaves differently and does not appear to be caused by libpairipcore.

So I believe it's not a duplicate of #405.

1. Install Qatar Airlines app.
2. Apply any module to the app. (No reboot needed.)
3. Run it.

I tested the four modules for the app and applying any of them causes the QA app to crash.

Expected behaviour/预期行为

Any module should be seamlessly injected to the app without causing it to crash.

Actual behaviour/实际行为

The app crashes at the very start.

Xposed Module List/Xposed 模块列表

* Call Recording 1.1
* CaptureSposed 1.0.7
* DisableAutoFocus 1.1.0
* Enable Screenshot: Swan Song Swan Song
* Firefox No Home Button 6
* GPS Setter 1.1.6
* Hide My Applist 3.5.r449.1d851a3
* InstaEclipse 0.4.3
* [JailMonkeyBypass](https://github.com/lyubomyr-shaydariv/jailmonkeybypass) 1.0
* (my private module, not published: removes igsh* URL tracking parameters from Instagram)
* Re:Telegram Akiyama
* ReVanced Xposed 1.0.23
* Telegram Speed Hook 2.1 AR
* XPL-EX 1.5.5

Root implementation/Root 方案

KernelSU Next 1.0.9 (22797)

System Module List/系统模块列表

* Always Trust User Certificates 1.3
* Anti bootloop 1.3.4
* Net Switch 1.2 (54-64b5764-release)
* PixelUpdater 0.121
* PlayIntegrityFix-NEXT 3.0
* Systemless Hosts - Unified 17.2-240906
* Tricky Store 1.3.0 (180-8acfa57-release)
* Zygisk - LSPosed 1.10.2 (7189-debug)
* Zygisk Next 1.2.9.1 (534-b8e7e21-release)

LSPosed version/LSPosed 版本

LSPosed version: 1.10.2 (7182) + Zygisk Next version: 1.2.9.1 (534-b8e7e21-release)

Android version/Android 版本

Android version: 16 (BP2A.250605.031.A2)

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

CaptureSposed-crash-logcat_2025-08-25_16-37-40.txt
CaptureSposed-crash-LSPosed_2025-08-25T16_37_31.324523.zip
GPS_Setter-crash-logcat_2025-08-25_16-41-19.txt
GPS_Setter-crash-LSPosed_2025-08-25T16_41_43.300870.zip
Hide_My_Applist-crash-logcat_2025-08-25_16-39-08.txt
Hide_My_Applist-crash-LSPosed_2025-08-25T16_39_33.847647.zip
XPL-EX-crash-logcat_2025-08-25_16-44-20.txt
XPL-EX-crash-LSPosed_2025-08-25T16_44_33.610843.zip

[Dev4Mod]

This isn't even a bug; the target app has protection to detect any lsposed injection. This applies to Google's peripcore protection. In this case, it's DexProtection.

I don't know if JingMatrix will implement something to hide lsposed, currently it is quite easy to detect an injection in libart and it is quite laborious to reverse engineer apps to understand their detections

[lyubomyr-shaydariv]

@Dev4Mod

This isn't even a bug; the target app has protection to detect any lsposed injection. This applies to Google's peripcore protection. In this case, it's DexProtection.

I don't know if JingMatrix will implement something to hide lsposed, currently it is quite easy to detect an injection in libart and it is quite laborious to reverse engineer apps to understand their detections

No no, I understand that there is currently no way to bypass libpairipcore and how much work it would require if it's even applicable to LSPosed. I mean that I understand why #405 was closed (however I'm still curious why the protection doesn't work unless the device is restarted). For this one, I don't know if this issue is caused by protection or something wrong in LSPosed. If @JingMatrix confirms it's protection and it's out of scope, no even a single question of why this issue was closed immediately.

[JingMatrix]

Regarding your courisity, did you really force stop the application in your experiments?

[lyubomyr-shaydariv]

@JingMatrix It's hard for me to say how it was back then.

I just reinstalled the app and re-enabled it in LSPosed so that XPL-EX would intercept it and block interaction with the clipboard. As a test, I tried pasting text from the clipboard into the app, and the text was successfully inserted. So I believe that interception doesn't work immediately after the app is installed. However, indeed, after a forced stop the app won't launch, replicating the behavior as if it were after a reboot.

[JingMatrix]

Yeap, so it implies that the refusal of functioning without crashes is how the app protects itself when injected.

[lyubomyr-shaydariv]

Where's my comment gone? 😅

@Dev4Mod

In this case, it's DexProtection.

Sorry, I missed this. What are the markers of this protection?

[google-mirror]

use shamiko to hide lsposed

[lyubomyr-shaydariv]

@google-mirror Not sure if it helps as having Shamiko installed makes no other effect for me.